FluentSecurity icon indicating copy to clipboard operation
FluentSecurity copied to clipboard

Inherit AuthorizeAttribute so 3rd parties can identify FluentSecurity as an authorization component

Open NightOwl888 opened this issue 10 years ago • 1 comments

As mentioned in #72, MvcSiteMapProvider can automatically pick up the authorization settings from FluentSecurity if it inherits AuthorizeAttribute.

Per this post, there are many built-in types in the MVC framework (and potentially by 3rd parties) that implement IAuthorizationFilter (including Controller), and most of these types do not provide any authorization capability. The only positive way to identify that a component is for MVC authorization is if it inherits AuthorizeAttribute. Since that is exactly what FluentSecurity does, it should inherit AuthorizeAttribute.

Although, admittedly on your side of the fence this looks a little like a hack because of the hidden properties, this fix creates the ideal scenario.

  1. If you install FluentSecurity, it will work.
  2. If you install MvcSiteMapProvider, it will work.
  3. If you install FluentSecurity and MvcSiteMapProvider, they will automatically interact.
  4. There are no dependencies required between the two libraries.
  5. There are no special cases in either library.
  6. There is no special configuration required for either library to make them interact.
  7. Other 3rd party components can potentially pick up FluentSecurity automatically, as well.

Do note that I put the property hiding in a separate commit in case you want to do it another way. Also note that the Order, Roles, and Users properties are only hidden if you access the library from another solution, but they are visible within the FluentSecuirty solution. If desired, you could also hide the protected members of AuthorizeAttribute so they aren't visible to inheritors of HandleSecurityAttribute.

This change is completely backward compatible with the current implementation.

I tested it with MvcSiteMapProvider and it is working. I also verified the build script is working.

NightOwl888 avatar Feb 20 '14 11:02 NightOwl888

Thanks for the pull-request. I've added some comment about this to the original issue (#72: Why doesn't HandleSecurityAttribute inherit AuthorizeAttribute?)

kristofferahl avatar Mar 14 '14 12:03 kristofferahl